CVE-2015-7828

High

Published: 10/11/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

SAP HANA Database 1.00 SPS10 and earlier do not require authentication, allowing remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet.

Risk Assessment

The lack of authentication poses a serious security risk, enabling attackers to remotely take control of the system.

Recommendation

It is recommended to upgrade to a newer version of SAP HANA that requires authentication to minimize the risk of unauthorized access.

Other vulnerabilities in SAP HANA Database

CVE-2026-44753Low
A vulnerability in SAP HANA Database (user self service tools) allows an unauthenticated attacker to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could lead to account enumeration, resulting in low impact on confidentiality, with no impact on integrity and availability.

Original NVD description (English source)

SAP HANA Database 1.00 SPS10 and earlier do not require authentication, which allows remote attackers to execute arbitrary code or have unspecified other impact via a TrexNet packet to the (1) fcopydir, (2) fmkdir, (3) frmdir, (4) getenv, (5) dumpenv, (6) fcopy, (7) fput, (8) fdel, (9) fmove, (10) fget, (11) fappend, (12) fdir, (13) getTraces, (14) kill, (15) pexec, (16) stop, or (17) pythonexec method, aka SAP Security Note 2165583.